CVE-2026-44950
published 2026-09-10CVE-2026-44950: fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the…
PriorityP358critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
EPSS
0.44%
36.9th percentile
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.
A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libxfont | libxfont | ? – 2.0.8 | — |
| suse | container_suse_kiosk_tigervnc-x11vnc_1.14-63.8 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | container_suse_kiosk_xorg_21.1-83.7 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles-sap-azure | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-azure-3p | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-azure | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-ec2 | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-gce-3p | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sapcal-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles12-sp5-azure-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-azure-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-ec2-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-ec2-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-gce-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-gce-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles15-sp6-sap | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-azure | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-azure-3p | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-azure | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-ec2 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-gce | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-ec2 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
vendor_redhat·2026-08-05·CVSS 7.5
CVE-2026-44950 [HIGH] CWE-120 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.
Statement: This is an Important flaw. A heap buffer overflow in the `libXfont2` font server client can be triggered by a malicious font server. I
VulDB
libXfont2 Font Server Client heap-based overflow
vuldb·2026-08-18
CVE-2026-44950 libXfont2 Font Server Client heap-based overflow
A vulnerability was found in libXfont2. It has been declared as very critical. This issue affects some unknown processing of the component Font Server Client. Executing a manipulation can lead to heap-based buffer overflow.
This vulnerability is handled as CVE-2026-44950. The attack can be executed remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44950 libXfont2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client [fedora-all]
bugzilla·2026-08-11·CVSS 7.5
CVE-2026-44950 [HIGH] CVE-2026-44950 libXfont2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client [fedora-all]
CVE-2026-44950 libXfont2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencin
Bugzilla
CVE-2026-44950 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
bugzilla·2026-07-30·CVSS 7.5
CVE-2026-44950 [HIGH] CVE-2026-44950 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
CVE-2026-44950 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64) so that each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte heap buffer. This is a heap buffer overflow with attacker-controlled content and
2026-09-10
Published